CVE-2025-32886

Executive Summary

CVE-2025-32886 exposes a critical information disclosure vulnerability in goTenna v1 devices running app version 5.5.3 and firmware 0.25.5. The flaw allows an attacker with local access (via USB) to intercept all RF (radio frequency) packets as they are simultaneously transmitted over the UART (Universal Asynchronous Receiver-Transmitter) interface. This effectively bypasses the intended RF-only communication model, leaking the full protocol payload and sensitive data to any local user with a USB shell connection.

The vulnerability is unpatched, and no official fix has been released by goTenna. The CVSS score is 4.0 (Medium), reflecting the requirement for local access but the high impact on confidentiality of transmitted data.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a hardware/firmware issue specific to goTenna v1 devices.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – Requires physical USB connection.
• Attack Complexity (AC): Low (L) – No special conditions needed.
• Privileges Required (PR): Low (L) – Requires a user-level shell.
• User Interaction (UI): None (N) – No user action needed beyond connection.
• Scope (S): Unchanged (U) – The vulnerable component is the device itself.
• Confidentiality (C): Low (L) – Only RF packet data is exposed.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. While local access is required, the vulnerability completely undermines the security model of goTenna devices, which rely on RF-only communication for privacy. An attacker with brief physical access can capture all past and future communications.

Deep Dive & Mechanics

The goTenna v1 device is a mesh networking radio that communicates over RF frequencies. It is designed to operate without any internet or cellular infrastructure, providing off-grid messaging. The device exposes a UART interface for debugging and firmware updates, accessible via a USB connection.

The vulnerability lies in the firmware’s implementation of the packet forwarding logic. When a packet is transmitted over RF, the firmware also sends an identical copy of the packet over the UART interface. This is likely a debugging feature left enabled in production firmware. The UART output is accessible through a USB shell (e.g., via a serial terminal program like screen or minicom).

Attack Flow:

1. Attacker gains physical access to a goTenna v1 device.
2. Attacker connects a USB cable to the device and opens a serial terminal (e.g., screen /dev/ttyUSB0 115200).
3. The device continues normal operation, sending and receiving RF packets.
4. Every RF packet is echoed to the UART, allowing the attacker to capture the raw protocol data, including message content, routing information, and potentially encryption keys if improperly handled.

The protocol is proprietary, but the leaked data includes all fields of the RF packet, enabling reverse engineering of the communication protocol and interception of sensitive messages.

Vulnerable vs. Patched Code

No patched code is available. The vulnerable behavior is in the firmware’s packet handling routine. A hypothetical fix would involve removing or conditionally disabling the UART echo of RF packets.

Vulnerable (pseudocode):

void send_rf_packet(packet_t *pkt) {
    rf_transmit(pkt);
    uart_send(pkt); // VULNERABLE: echoes packet to UART
}

Patched (hypothetical):

void send_rf_packet(packet_t *pkt) {
    rf_transmit(pkt);
    // uart_send(pkt); // REMOVED: no longer echoes to UART
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• goTenna v1 device with app 5.5.3 and firmware 0.25.5.
• USB cable.
• Computer with a serial terminal (e.g., screen, minicom, PuTTY).

Steps:

1. Connect the goTenna device to your computer via USB.
2. Identify the serial port (e.g., /dev/ttyUSB0 on Linux).
3. Open a serial connection with baud rate 115200:

   screen /dev/ttyUSB0 115200
   

4. Observe the output. Every RF packet transmitted or received by the device will appear as raw hex or ASCII data.
5. Capture the output to a file for analysis:

   screen -L /dev/ttyUSB0 115200
   

   The -L flag logs output to screenlog.0.

Example Output (simulated):

[RF TX] 0x01 0x02 0x03 0x04 ... (message: "Hello")
[RF RX] 0x05 0x06 0x07 0x08 ... (message: "World")

Blue Team (Detection & Defense)

Detection:

• Monitor for unauthorized USB connections to goTenna devices.
• Use endpoint detection and response (EDR) to detect serial terminal software (e.g., screen, minicom) running on systems with goTenna devices attached.
• Check for unexpected UART activity on the device’s USB port.

Mitigation:

• Physically secure goTenna devices to prevent unauthorized USB access.
• Disable UART shell in firmware if possible (requires vendor patch).
• Use encryption at the application layer to protect message content even if RF packets are intercepted.
• Implement USB port locks or disable USB ports on devices used with goTenna.

Indicators of Compromise (IOCs)

• Network: Unusual serial port activity on a system connected to a goTenna device.
• Host: Presence of serial terminal software (e.g., screen, minicom) on a system that does not normally use it.
• File: Log files containing raw RF packet data (e.g., screenlog.0).
• Process: Running processes like screen, minicom, or putty with serial port arguments.

Detection Engineering

YARA Rule

rule CVE_2025_32886_goTenna_UART_Leak {
    meta:
        description = "Detects goTenna UART packet leak in serial logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-32886"
    strings:
        $rf_tx = "[RF TX]" ascii wide nocase
        $rf_rx = "[RF RX]" ascii wide nocase
        $gotenna = "goTenna" ascii wide nocase
    condition:
        all of ($rf_tx, $rf_rx) or ($gotenna and any of ($rf_tx, $rf_rx))
}

Sigma Rule

title: goTenna UART Packet Leak Detection
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects serial terminal usage on systems with goTenna devices
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-32886
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\screen.exe'
            - '\minicom.exe'
            - '\putty.exe'
        CommandLine|contains:
            - 'ttyUSB'
            - 'COM'
    condition: selection
falsepositives:
    - Legitimate debugging activities
level: medium

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-32886 goTenna UART Packet Leak"; flow:to_server; content:"[RF TX]"; nocase; content:"[RF RX]"; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Physical Security: Restrict physical access to goTenna v1 devices. Use tamper-evident seals or lockable enclosures.
2. Disable UART Shell: If possible, modify the device firmware to disable the UART shell. This may require reflashing with custom firmware.
3. Encrypt Communications: Use end-to-end encryption for all messages sent over goTenna. The device’s RF protocol may not provide encryption by default.

Long-Term Fix:

• Contact goTenna support for an official patch. As of this report, no patch is available.
• Consider upgrading to a newer goTenna model that does not have this vulnerability.

Workaround:

• Use a USB data blocker (USB condom) that only allows power, not data, when charging the device. This prevents UART access while still allowing charging.

Valters IT